[Tutorial] How to create a custom signed vbmeta.img for Unisoc using AVBtool
[Tutorial] How to create a custom signed vbmeta.img for Unisoc using AVBtool
08-08-2025, 12:00 PM
Hello,
sorry for not understanding the answer.
I took your rsa4096_vbmeta.pem and ran the command
python avbtool extract_public_key --key rsa4096_vbmeta.pem --output keys/hovatek.bin
Than I ran the command to create a vbmeta-sign-custom.img
avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/hovatek.bin --chain_partition vendor_boot:14:keys/hovatek.bin --chain_partition dtbo:6:keys/dtbo_key.bin --chain_partition vbmeta_system:2:keys/vbmeta_system_key.bin --chain_partition vbmeta_system_ext:3:keys/vbmeta_system_ext_key.bin --chain_partition vbmeta_vendor:4:keys/vbmeta_vendor_key.bin --chain_partition vbmeta_product:5:keys/vbmeta_product_key.bin --chain_partition l_modem:7:keys/l_modem_key.bin --chain_partition l_ldsp:8:keys/l_ldsp_key.bin --chain_partition l_gdsp:9:keys/l_gdsp_key.bin --chain_partition pm_sys:10:keys/pm_sys_key.bin --chain_partition l_agdsp:11:keys/l_agdsp_key.bin --padding_size 16384 --output vbmeta-sign-custom.img
After that I was padding the custom vbmeta with command
python vbmeta_pad.py
Compared it with the original vbmeta and - because of differences - copied the DHTP section from the orignal to the custom.
All steps as described in your tutorial.
Then I try to flash:
fastboot flash vbmeta-sign vbmeta-sign-custom.img
and it failed:
Warning: skip copying vbmeta-sign image avb footer (vbmeta-sign partition size: 0, vbmeta-sign image size: 1048576).
Sending 'vbmeta-sign' (1024 KB) OKAY [ 0.024s]
Writing 'vbmeta-sign' FAILED (remote: 'Write img fail!')
fastboot: error: Command failed
I have created a signed boot image with command:
avbtool add_hash_footer --image mboot.img --partition_name boot --partition_size 67108864 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096
The public key in the signed boot image is the same as in the vbmeta-custom.
Thank you very much!
09-08-2025, 08:48 AM
(08-08-2025, 12:00 PM)chklotzba ..
Compared it with the original vbmeta and - because of differences - copied the DHTP section from the orignal to the custom.
..
I think this is where the problem is coming from. Share the vbmeta_pad.py you're using.
You're not supposed to copy anything via hex editor manually. Let the vbmeta_pad.py do that
To avoid getting confused, redo your make_vbmeta_image command with flag 0, don't swap any public key with hovatek.bin then wait (don't run vbmeta_pad.py yet till we make necessary adjustments)
Update:
The vbmeta_pad.py should be something like this
Code:
import hashlib
import sys
f = open("vbmeta-sign-custom.img", "rb")
b = f.read()
sha = hashlib.sha256(b).digest()
f.close()
f = open("vbmeta-sign-custom.img", "wb")
f.write(b)
f.seek(1048576 - 512)
f.write(b'\x44\x48\x54\x42\x01\x00\x00\x00')
f.write(sha)
f.write(b'\xCC\xCC\xCC\xCC\xAA\xAA\xAA\xAA\x00\x40\x00\x00')
f.seek(0xffe3d)
f.write(b'\x40')
f.seek(0xffe40)
f.write(b'\x60\x42')
f.seek(1048576 - 1)
f.write(b'\x00')
f.close() This post was last modified: 09-08-2025, 09:34 AM by maxpayne.
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
09-08-2025, 12:27 PM
I created now a key chklotzba.bin by using rsa4096 with command:
avbtool extract_public_key --key rsa4096_vbmeta.pem --output keys/chklotzba.bin
and made a custom vbmeta with command:
avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/chklotzba.bin --chain_partition vendor_boot:14:keys/chklotzba.bin --chain_partition dtbo:6:keys/dtbo_key.bin --chain_partition vbmeta_system:2:keys/vbmeta_system_key.bin --chain_partition vbmeta_system_ext:3:keys/vbmeta_system_ext_key.bin --chain_partition vbmeta_vendor:4:keys/vbmeta_vendor_key.bin --chain_partition vbmeta_product:5:keys/vbmeta_product_key.bin --chain_partition l_modem:7:keys/l_modem_key.bin --chain_partition l_ldsp:8:keys/l_ldsp_key.bin --chain_partition l_gdsp:9:keys/l_gdsp_key.bin --chain_partition pm_sys:10:keys/pm_sys_key.bin --chain_partition l_agdsp:11:keys/l_agdsp_key.bin --padding_size 16384 --output vbmeta-sign-custom.img
Or should I use the original bin-file from the pac I get from Blackview?
The vbmeta_pad.py is (it`s the one you provided for Android9:
import hashlib
import sys
f = open("vbmeta-sign-custom.img", "rb")
b = f.read()
sha = hashlib.sha256(b).digest()
f.close()
f = open("vbmeta-sign-custom.img", "wb")
f.write(b)
f.seek(1048576 - 512)
f.write(b'\x44\x48\x54\x42\x01\x00\x00\x00')
f.write(sha)
f.write(b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00')
f.seek(1048576 - 1)
f.write(b'\x00')
f.close()
But what confuses me more is, that I try for testing to flash the original vbmeta-sign.img and I got the same error:
Warning: skip copying vbmeta-sign image avb footer (vbmeta-sign partition size: 0, vbmeta-sign image size: 1048576).
Sending 'vbmeta-sign' (1024 KB) OKAY [ 0.026s]
Writing 'vbmeta-sign' FAILED (remote: 'Write img fail!')
fastboot: error: Command failed
But this should work? Is it impossible to flash any with this device?
Thank you very much!
09-08-2025, 07:02 PM
(09-08-2025, 12:36 PM)chklotzba Sorry for my mistake, I created again with Flag 0 and wait :-)
Please read my previous response again.
I gave instructions on creating the vbmeta and the contents of vbmeta_pad.py to use
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
10-08-2025, 01:17 PM
I did everything as told with the new vbmeta_pad.py
But the same fault was shown as I flashed the custom vbmeta and (for testing) the original vbmeta:
Warning: skip copying vbmeta-sign image avb footer (vbmeta-sign partition size: 0, vbmeta-sign image size: 1048576).
Sending 'vbmeta-sign' (1024 KB) OKAY [ 0.024s]
Writing 'vbmeta-sign' FAILED (remote: 'Write img fail!')
fastboot: error: Command failed
11-08-2025, 12:38 PM
(10-08-2025, 01:17 PM)chklotzba Hello,
I did everything as told with the new vbmeta_pad.py
But the same fault was shown as I flashed the custom vbmeta and (for testing) the original vbmeta:
..
Try flashing the stock vbmeta and check if it flashes
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
11-08-2025, 04:19 PM
the flashing via Fastboot didn`t work. But I could flash it with the recovey tool. The vbmeta and the boot.img patched with Magisk. Now my Tab is rooted.
I also try to flash a TWRP vendor_boot.img created by your tool and it worked, but I can`t mount the data partition. But I think this is for a new thread.
Thank you for your help!
Users browsing this thread:
2 Guest(s)
2 Guest(s)
Users browsing this thread:
2 Guest(s)
2 Guest(s)
